CVE-2026-64628 describes a stored cross-site scripting vulnerability in the Grav CMS shortcode-core attribute handlers. The XSS detection mechanism is insufficient as it only detects payloads containing literal angle brackets, enabling attackers to craft shortcode parameters that bypass this validation. An attacker with admin.pages permission can inject malicious JavaScript code into shortcode attributes, which executes in the browsers of any users viewing the affected content, including administrators. This can lead to session hijacking through theft of admin nonces. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.1. No official fix or patch has been documented as of the published date.

Successful exploitation allows an attacker with admin.pages permission to inject persistent malicious JavaScript into Grav pages via shortcode attributes. This script executes in the context of any user viewing the page, including administrators, potentially enabling session hijacking by stealing admin nonces. This compromises the confidentiality and integrity of administrative sessions. The vulnerability does not require user interaction beyond viewing the affected page and has a network attack vector with low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict admin.pages permissions to trusted users only and consider reviewing shortcode usage policies to limit exposure. Monitor vendor channels for updates and apply patches promptly once released.